GRC Analyst

The world of digital assets is accelerating in speed, magnitude, and complexity, opening the door to new ways for leveraging the blockchain. Fireblocks' platform and network provide the simplest and most secure way for companies to work with digital assets, and it's trusted by some of the largest financial institutions, banks, globally-recognized brands, and Web3 companies in the world, including BNY Mellon, BNP Paribas, ANZ Bank, Revolut, and thousands more.

You will be the single owner of the SOC 1 control environment, accountable for the program from evidence through report issuance:

• Own the evidence: Personally collect, label, and file control evidence and screenshots. Maintain an audit-ready repository that stays current all year, not just at cycle time.
• Define the requirements: Translate each control objective into testable specifications for Engineering, Infrastructure, Security, HR, and Finance. Identify gaps and drive them closed.
• Run the auditor relationship: Act as the primary contact for our external auditors. Manage the auditor transition, scoping, walkthroughs, PBC and sample requests, evidence delivery, and resolution of deviations.
• Represent us to customers: Lead customer-facing calls on the SOC 1 control environment, answer control questions directly, and confirm complementary user-entity controls (IP allowlisting, MFA, access approvals, authorized-user lists).
• Execute the recurring controls: Run the operating cadence — weekly reconciliation minutes; quarterly access reviews; and the annual cycle covering penetration testing, cloud (AWS) SOC report review, board minutes, performance evaluations, and security training, including 30-day new-hire training.
• Manage the access lifecycle: Oversee access-request approvals, terminations and offboarding, and privileged-access lists.
• Hold the line on operational controls: Cover monitoring, vulnerability scanning (no open critical or high findings), backup and BCP/DR, and incident records.

• 3-5 years in IT compliance, IT audit, or GRC, including at least one full SOC 1 Type II cycle owned hands-on, from evidence collection through report issuance.
• Finance reconciliation expertise: A strong grasp of transaction and balance reconciliation, controls over completeness and accuracy, and discrepancy resolution. Crypto or digital-asset reconciliation experience is a strong plus.
• Hands-on tooling fluency: Comfortable working directly in AWS (IAM/SSO), GitHub, ticketing systems, monitoring, vulnerability scanners, and compliance tooling.
• Documentation discipline: You produce clear, structured, audit-grade documentation as a matter of habit.

• Cross-functional credibility: You're equally credible with engineers, finance teams, and external auditors, and you can move between those audiences without losing precision.
• Customer-facing composure: You can represent a control environment to customers and stand behind it under scrutiny.
• Ownership mindset: You treat the program as yours. You chase down evidence, follow up on gaps, and keep the repository ready without being asked.
• Bias toward the practical: You balance control rigor with the realities of a fast-moving, global financial infrastructure business.

Fireblocks' mission is to enable every business to easily and securely access digital assets and cryptocurrencies. In order to do that, we strongly believe our workforce should be as diverse as our clients, and this is why we embrace diversity and inclusion in all its forms.

Please see our candidate privacy policy here.